release.yml

name: Generate Release and Deploy to Production

on:
  push:
    branches:
      - main
  workflow_dispatch:  # Allow manual trigger
  repository_dispatch:  # Allow trigger from other repos (e.g., RavenBrain)
    types: [deploy]

jobs:
  publish:
    if: github.event_name != 'repository_dispatch'
    permissions:
      contents: write
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest

    outputs:
      released: ${{ steps.semantic.outputs.new_release_published }}
      version: ${{ steps.semantic.outputs.new_release_version }}
      tag: ${{ steps.semantic.outputs.new_release_git_tag }}

    steps:
      - name: Generate release bot token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
          token: ${{ steps.app-token.outputs.token }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'

      - name: Install dependencies
        run: npm ci

      - name: Check Types
        run: npm run typecheck

      - name: Build (validation only — rebuilt in build job with correct version)
        env:
          VITE_API_HOST: ${{ vars.VITE_API_HOST || 'https://ravenbrain.team1310.ca' }}
        run: npm run build

      - name: Semantic Release
        id: semantic
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          node --input-type=module << 'EOF'
          import semanticRelease from 'semantic-release';
          import { appendFileSync } from 'fs';

          const result = await semanticRelease();
          const output = process.env.GITHUB_OUTPUT;

          if (result) {
            appendFileSync(output, `new_release_published=true\n`);
            appendFileSync(output, `new_release_version=${result.nextRelease.version}\n`);
            appendFileSync(output, `new_release_git_tag=${result.nextRelease.gitTag}\n`);
            console.log(`Released ${result.nextRelease.version}`);
          } else {
            appendFileSync(output, `new_release_published=false\n`);
            console.log('No release published');
          }
          EOF

  build:
    needs: publish
    if: needs.publish.outputs.released == 'true'
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest

    outputs:
      image: ${{ steps.image-name.outputs.image }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.publish.outputs.tag }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'

      - name: Install dependencies
        run: npm ci

      - name: Build
        env:
          VITE_API_HOST: ${{ vars.VITE_API_HOST || 'https://ravenbrain.team1310.ca' }}
        run: npm run build

      - name: Set image name
        id: image-name
        run: echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: linux/amd64
          tags: |
            ${{ steps.image-name.outputs.image }}:${{ needs.publish.outputs.version }}
            ${{ steps.image-name.outputs.image }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # Unified deploy job handles both RavenEye builds and external triggers (e.g., RavenBrain)
  # External trigger: echo '{"event_type":"deploy","client_payload":{"service":"app"}}' | gh api repos/RunnymedeRobotics1310/RavenEye/dispatches --input -
  deploy:
    needs: build
    if: always() && (needs.build.result == 'success' || github.event_name == 'repository_dispatch')
    permissions:
      contents: read
      packages: read
    runs-on: self-hosted

    steps:
      - name: Determine deployment target
        id: target
        run: |
          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
            SERVICE="${{ github.event.client_payload.service || 'app' }}"
            if [ "$SERVICE" = "app" ]; then
              IMAGE="ghcr.io/runnymederobotics1310/ravenbrain:latest"
            else
              IMAGE="ghcr.io/runnymederobotics1310/raveneye:latest"
            fi
          else
            SERVICE="nginx"
            IMAGE="${{ needs.build.outputs.image }}:latest"
          fi
          echo "service=$SERVICE" >> $GITHUB_OUTPUT
          echo "image=$IMAGE" >> $GITHUB_OUTPUT
          echo "Deploying $SERVICE using $IMAGE"

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull latest image
        run: docker pull ${{ steps.target.outputs.image }}

      - name: Deploy service
        run: |
          RAVENEYE_IMAGE=${{ steps.target.outputs.image }} \
            docker compose --env-file /opt/raveneye-config/.env \
              -f docker-compose.yml -f docker-compose.prod.yml up -d ${{ steps.target.outputs.service }}

      - name: Verify deployment
        run: |
          echo "Waiting for ${{ steps.target.outputs.service }} to start..."
          sleep 10
          docker compose --env-file /opt/raveneye-config/.env \
            -f docker-compose.yml -f docker-compose.prod.yml ps ${{ steps.target.outputs.service }}
          echo "Deployment complete"

      - name: Cleanup old images
        run: docker image prune -f